使用AWS re:Post即您表示您同意 AWS re:Post 使用条款

How to avoid circular dependencies between EFS and access point in file system policy of Cloudformation template

0

When I try to follow example 3 in the following page to prepare for EFS file system policy in a cloudformation template, I notice that it will cause circular dependency.

https://docs.aws.amazon.com/efs/latest/ug/iam-access-control-nfs-efs.html

{
    "Id": "access-point-example03",
    "Statement": [
        {
            "Sid": "access-point-statement-example03",
            "Effect": "Allow",
            "Principal": {"AWS": "arn:aws:iam::555555555555:role/EfsAccessPointFullAccess"},
            "Action": "elasticfilesystem:Client*",
            "Resource": "arn:aws:elasticfilesystem:us-east-2:111122223333:file-system/fs-12345678",
            "Condition": { 
                "StringEquals": {
                    "elasticfilesystem:AccessPointArn":"arn:aws:elasticfilesystem:us-east-2:555555555555:access-point/fsap-12345678" } 
            }            
        }
    ]
}

The file system policy is a part of the file system resource and it's referring the ARN of the access point. The access point resource must refer to the file system resource. Are there any ways that the condition can be written without the ARN of the access points such that the circular dependency can be avoided?

It seems not possible since there are only three conditions keys for client: aws:SecureTransport, elasticfilesystem:AccessPointArn, elasticfilesystem:AccessedViaMountTarget

So, it seems that we need to enforce the control in IAM policies if we also want to use Cloudformation.

1 回答
0

Some findings after some experiments:

  1. No such issue with Terraform HCL since file system policy is a separate resource.
  2. Have tried with ECS tasks. It seems that EFS actions are implicitly allowed. An explicit deny IAM policy can be added to the task role to force the ECS task to access the file system through access point.
已回答 2 年前

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则